{"id":"CVE-2016-1237","aliases":["DEBIAN-CVE-2016-1237","DSA-3607-1","EUVD-2016-2338","GHSA-r3gq-m2h3-69wv","MGASA-2016-0271","MGASA-2016-0283","MGASA-2016-0284","UBUNTU-CVE-2016-1237","USN-3053-1","USN-3070-1","USN-3070-2","USN-3070-3","USN-3070-4","openSUSE-SU-2024:10128-1"],"status":"published","title":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission...","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.00364,"percentile":0.30424,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-06-28T00:00:00Z","modified":"2026-09-22T07:00:38Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.6.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.6.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.6.2-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-66.74~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-36.55~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-36.55"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1021.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1024.27"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt25-2+deb8u2"}]}],"versions":["3.16.7-ckt11-1","3.16.7-ckt11-1+deb8u1","3.16.7-ckt11-1+deb8u2","3.16.7-ckt11-1+deb8u2~bpo70+1","3.16.7-ckt11-1+deb8u3","3.16.7-ckt11-1+deb8u3~bpo70+1","3.16.7-ckt11-1+deb8u4","3.16.7-ckt11-1+deb8u4~bpo70+1","3.16.7-ckt11-1+deb8u5","3.16.7-ckt11-1+deb8u6","3.16.7-ckt11-1+deb8u6~bpo70+1","3.16.7-ckt11-1~bpo70+1","3.16.7-ckt17-1","3.16.7-ckt20-1","3.16.7-ckt20-1+deb8u1","3.16.7-ckt20-1+deb8u2","3.16.7-ckt20-1+deb8u2~bpo70+1","3.16.7-ckt20-1+deb8u3","3.16.7-ckt20-1+deb8u3~bpo70+1","3.16.7-ckt20-1+deb8u4","3.16.7-ckt20-1+deb8u4~bpo70+1","3.16.7-ckt25-1","3.16.7-ckt25-1~bpo70+1","3.16.7-ckt25-2","3.16.7-ckt25-2+deb8u1","3.16.7-ckt25-2~bpo70+1","3.16.7-ckt9-2","3.16.7-ckt9-3","3.16.7-ckt9-3~deb8u1","3.16.7-ckt9-3~deb8u1~bpo70+1"],"bundled":37},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.16-1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.16-1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-2.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-2.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-8.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.16-1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.16-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-66.74~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1","3.19.0-58.64~14.04.1","3.19.0-59.65~14.04.1","3.19.0-59.66~14.04.1","3.19.0-61.69~14.04.1","3.19.0-64.72~14.04.1","3.19.0-65.73~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1021.27"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1024.27"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-66.74~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1","3.19.0-58.64~14.04.1","3.19.0-59.65~14.04.1","3.19.0-59.66~14.04.1","3.19.0-61.69~14.04.1","3.19.0-64.72~14.04.1","3.19.0-65.73~14.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1021.27"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1024.27"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.13-1.1"}]}],"bundled":82}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-3070-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1350845","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.ubuntu.com/usn/USN-3053-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/06/25/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3070-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3607","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3070-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://github.com/torvalds/linux/commit/999653786df6954a31044528ac3f7a5dadca08f4","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/91456","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3070-4","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=999653786df6954a31044528ac3f7a5dadca08f4","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1237"},{"url":"https://github.com/advisories/GHSA-r3gq-m2h3-69wv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1237","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0271.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19055","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.14","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.15","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.16","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0283.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19056","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2016-0284.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1237","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3053-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6197","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9576","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-1237","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2016-06-29T14:00:00Z","modified":"2024-08-05T22:48:13.629Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-2338","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2016-06-29T14:00:00Z","modified":"2024-08-05T22:48:13Z","updated_at":"2026-11-03T02:22:57.974183Z"}],"ghsa":[{"id":"GHSA-r3gq-m2h3-69wv","title":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission...","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2022-05-17T03:43:05Z","modified":"2023-01-27T05:09:03Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:43:21.16147Z"}],"nvd":[{"id":"CVE-2016-1237","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2016-06-29T14:10:01.457Z","modified":"2026-06-17T00:41:31.71Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-1237","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2016-06-29T14:10:01.457Z","modified":"2026-04-16T06:17:55.983012634Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1237","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2016-06-29T14:10:01.457Z","modified":"2026-09-22T07:00:38.498322354Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1237","description":"nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.","status":"published","published":"2016-06-29T00:00:00Z","modified":"2026-04-22T10:31:07.549632Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DSA-3607-1","title":"linux - security update","status":"published","published":"2016-06-28T00:00:00Z","modified":"2026-03-09T01:21:44.956801Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0271","title":"Updated kernel packages fix security vulnerability","description":"This update is based on the upstream 4.4.16 kernel and fixes at least theese\nsecurity issues:\n\nnfsd in the Linux kernel through 4.6.3 allows local users to bypass intended\nfile-permission restrictions by setting a POSIX ACL, related to nfs2acl.c,\nnfs3acl.c, and nfs4acl.c. (CVE-2016-1237).\n\nThe ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux\nkernel before 4.6.3 allows  local users to gain privileges or cause a denial\nof service (stack memory consumption) via vectors involving crafted mmap\ncalls for /proc pathnames, leading to recursive pagefault handling\n(CVE-2016-1583). \n\nThe key_reject_and_link function in security/keys/key.c in the Linux kernel\nthrough 4.6.3 does not ensure that a certain data structure is initialized,\nwhich allows local users to cause a denial of service (system crash) via\nvectors involving a crafted keyctl request2 command (CVE-2016-4470).\n\nUse-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6\nallows local users to cause a denial of service (BUG) or possibly have\nunspecified other impact via crafted use of the mmap and bpf system calls\n(CVE-2016-4794).\n\nThe tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel\nthrough 4.6 does not verify socket existence, which allows local users to\ncause a denial of service (NULL pointer dereference and system crash) or\npossibly have unspecified other impact via a dumpit operation\n(CVE-2016-4951).\n\nThe compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter\nsubsystem in the Linux kernel before 4.6.3 allows local users to gain\nprivileges or cause a denial of service (memory corruption) by leveraging\nin-container root access to provide a crafted offset value that triggers\nan unintended decrement. (CVE-2016-4997).\n\nThe IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem\nin the Linux kernel before 4.6 allows local users to cause a denial of\nservice (out-of-bounds read) or possibly obtain sensitive information from\nkernel heap memory by leveraging in-container root access to provide a\ncrafted offset value that leads to crossing a ruleset blob boundary\n(CVE-2016-4998).\n\nA flaw was found in the implementation of the Linux kernel handling of\nnetworking challenge ack where an attacker is able to determine the\nshared counter. This may allow an attacker to inject or take over a TCP\nconnection between a server and client without having to be a traditional\nMan In the Middle (MITM) style attack (CVE-2016-5696).\n\nMultiple heap-based buffer overflows in the hiddev_ioctl_usage function in\ndrivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local\nusers to cause a denial of service or possibly have unspecified other impact\nvia a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call\n(CVE-2016-5829).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-07-31T20:39:13Z","modified":"2026-04-16T06:25:24.30681096Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2016-0283","title":"Updated kernel-tmb packages fix security vulnerabilities","description":"This update is based on the upstream 4.4.16 kernel and fixes at least theese\nsecurity issues:\n\nnfsd in the Linux kernel through 4.6.3 allows local users to bypass intended\nfile-permission restrictions by setting a POSIX ACL, related to nfs2acl.c,\nnfs3acl.c, and nfs4acl.c. (CVE-2016-1237).\n\nThe ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux\nkernel before 4.6.3 allows  local users to gain privileges or cause a denial\nof service (stack memory consumption) via vectors involving crafted mmap\ncalls for /proc pathnames, leading to recursive pagefault handling\n(CVE-2016-1583). \n\nThe key_reject_and_link function in security/keys/key.c in the Linux kernel\nthrough 4.6.3 does not ensure that a certain data structure is initialized,\nwhich allows local users to cause a denial of service (system crash) via\nvectors involving a crafted keyctl request2 command (CVE-2016-4470).\n\nUse-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6\nallows local users to cause a denial of service (BUG) or possibly have\nunspecified other impact via crafted use of the mmap and bpf system calls\n(CVE-2016-4794).\n\nThe tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel\nthrough 4.6 does not verify socket existence, which allows local users to\ncause a denial of service (NULL pointer dereference and system crash) or\npossibly have unspecified other impact via a dumpit operation\n(CVE-2016-4951).\n\nThe compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter\nsubsystem in the Linux kernel before 4.6.3 allows local users to gain\nprivileges or cause a denial of service (memory corruption) by leveraging\nin-container root access to provide a crafted offset value that triggers\nan unintended decrement. (CVE-2016-4997).\n\nThe IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem\nin the Linux kernel before 4.6 allows local users to cause a denial of\nservice (out-of-bounds read) or possibly obtain sensitive information from\nkernel heap memory by leveraging in-container root access to provide a\ncrafted offset value that leads to crossing a ruleset blob boundary\n(CVE-2016-4998).\n\nA flaw was found in the implementation of the Linux kernel handling of\nnetworking challenge ack where an attacker is able to determine the\nshared counter. This may allow an attacker to inject or take over a TCP\nconnection between a server and client without having to be a traditional\nMan In the Middle (MITM) style attack (CVE-2016-5696).\n\nMultiple heap-based buffer overflows in the hiddev_ioctl_usage function in\ndrivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local\nusers to cause a denial of service or possibly have unspecified other impact\nvia a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call\n(CVE-2016-5829).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:23:29.057382783Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2016-0284","title":"Updated kernel-linus packages fix security vulnerabilities","description":"This update is based on the upstream 4.4.16 kernel and fixes at least theese\nsecurity issues:\n\nnfsd in the Linux kernel through 4.6.3 allows local users to bypass intended\nfile-permission restrictions by setting a POSIX ACL, related to nfs2acl.c,\nnfs3acl.c, and nfs4acl.c. (CVE-2016-1237).\n\nThe ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux\nkernel before 4.6.3 allows  local users to gain privileges or cause a denial\nof service (stack memory consumption) via vectors involving crafted mmap\ncalls for /proc pathnames, leading to recursive pagefault handling\n(CVE-2016-1583). \n\nThe key_reject_and_link function in security/keys/key.c in the Linux kernel\nthrough 4.6.3 does not ensure that a certain data structure is initialized,\nwhich allows local users to cause a denial of service (system crash) via\nvectors involving a crafted keyctl request2 command (CVE-2016-4470).\n\nUse-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6\nallows local users to cause a denial of service (BUG) or possibly have\nunspecified other impact via crafted use of the mmap and bpf system calls\n(CVE-2016-4794).\n\nThe tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel\nthrough 4.6 does not verify socket existence, which allows local users to\ncause a denial of service (NULL pointer dereference and system crash) or\npossibly have unspecified other impact via a dumpit operation\n(CVE-2016-4951).\n\nThe compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter\nsubsystem in the Linux kernel before 4.6.3 allows local users to gain\nprivileges or cause a denial of service (memory corruption) by leveraging\nin-container root access to provide a crafted offset value that triggers\nan unintended decrement. (CVE-2016-4997).\n\nThe IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem\nin the Linux kernel before 4.6 allows local users to cause a denial of\nservice (out-of-bounds read) or possibly obtain sensitive information from\nkernel heap memory by leveraging in-container root access to provide a\ncrafted offset value that leads to crossing a ruleset blob boundary\n(CVE-2016-4998).\n\nMultiple heap-based buffer overflows in the hiddev_ioctl_usage function in\ndrivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local\nusers to cause a denial of service or possibly have unspecified other impact\nvia a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call\n(CVE-2016-5829).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:24:34.677678636Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10128-1","title":"kernel-debug-4.8.13-1.1 on GA media","description":"These are all security issues fixed in the kernel-debug-4.8.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:12.688384Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"USN-3053-1","title":"linux-lts-vivid vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nIt was discovered that the keyring implementation in the Linux kernel did\nnot ensure a data structure was initialized before referencing it after an\nerror condition occurred. A local attacker could use this to cause a denial\nof service (system crash). (CVE-2016-4470)\n\nSasha Levin discovered that a use-after-free existed in the percpu\nallocator in the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code with\nadministrative privileges. (CVE-2016-4794)\n\nKangjie Lu discovered an information leak in the netlink implementation of\nthe Linux kernel. A local attacker could use this to obtain sensitive\ninformation from kernel memory. (CVE-2016-5243)\n","status":"published","published":"2016-08-10T10:42:07Z","modified":"2026-02-10T04:41:01Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-1","title":"linux vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-29T19:01:14Z","modified":"2026-04-22T09:27:27.144137Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-2","title":"linux-raspi2 vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-30T16:22:36Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-3","title":"linux-snapdragon vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-30T16:28:23Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-4","title":"linux-lts-xenial vulnerabilities","description":"USN-3070-1 fixed vulnerabilities in the Linux kernel for Ubuntu\n16.04 LTS. This update provides the corresponding updates for the\nLinux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for\nUbuntu 14.04 LTS.\n\nA missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-30T16:47:18Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}